path: root/tools/cert_create/include/key.h
diff options
authorJuan Castillo <juan.castillo@arm.com>2015-06-01 16:34:23 +0100
committerJuan Castillo <juan.castillo@arm.com>2015-06-25 08:53:27 +0100
commitccbf890e5e2fb75b4df30f50f06c505702a0e01c (patch)
tree42a35e2e0f737b9eba3f92b20c5ccac9024a0672 /tools/cert_create/include/key.h
parentdff93c8675e5c7929c2c001034a82c115cdc1e6a (diff)
TBB: add ECDSA support to the certificate generation tool
This patch extends the 'cert_create' tool to support ECDSA keys to sign the certificates. The '--key-alg' command line option can be used to specify the key algorithm when invoking the tool. Available options are: * 'rsa': create RSA-2048 keys (default option) * 'ecdsa': create ECDSA-SECP256R1 keys The TF Makefile has been updated to allow the platform to specify the key algorithm by declaring the 'KEY_ALG' variable in the platform makefile. The behaviour regarding key management has changed. After applying this patch, the tool will try first to open the keys from disk. If one key does not exist or no key is specified, and the command line option to create keys has been specified, new keys will be created. Otherwise an error will be generated and the tool will exit. This way, the user may specify certain keys while the tool will create the remaining ones. This feature is useful for testing purposes and CI infrastructures. The OpenSSL directory may be specified using the build option 'OPENSSL_DIR' when building the certificate generation tool. Default is '/usr'. Change-Id: I98bcc2bfab28dd7179f17f1177ea7a65698df4e7
Diffstat (limited to 'tools/cert_create/include/key.h')
1 files changed, 17 insertions, 2 deletions
diff --git a/tools/cert_create/include/key.h b/tools/cert_create/include/key.h
index 881975005..dfb315086 100644
--- a/tools/cert_create/include/key.h
+++ b/tools/cert_create/include/key.h
@@ -35,6 +35,21 @@
#define RSA_KEY_BITS 2048
+/* Error codes */
+enum {
+/* Supported key algorithms */
+enum {
* This structure contains the relevant information to create the keys
* required to sign the certificates.
@@ -50,8 +65,8 @@ typedef struct key_s {
EVP_PKEY *key; /* Key container */
} key_t;
-int key_new(key_t *key);
-int key_load(key_t *key);
+int key_create(key_t *key, int type);
+int key_load(key_t *key, unsigned int *err_code);
int key_store(key_t *key);
#endif /* KEY_H_ */